littlesnitch-linux

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches source code from Objective Development's GitHub repository (github.com/obdev/littlesnitch-linux) and installs the bpf-linker utility via Cargo.
  • [COMMAND_EXECUTION]: Compiles and executes the downloaded Rust code using cargo build and cargo run to load eBPF programs into the Linux kernel.
  • [PRIVILEGE_ESCALATION]: Utilizes sudo and kernel capabilities (cap_bpf, cap_net_admin) to permit the loading of network monitoring programs into the kernel, which is a required step for eBPF functionality.
  • [INDIRECT_PROMPT_INJECTION]: Ingests hostnames and IP addresses from local configuration files (blocked_hosts.txt, blocked_domains.txt) and reads network event data from the kernel perf buffer. The skill includes basic parsing and display of this data for monitoring purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:36 AM